System and method for monitoring computer usage

ABSTRACT

A system and method for monitoring computer usage is disclosed. A computer operator specifies discrete moments of a computer&#39;s usage at which screen captures are executed and saved to a log. The operator, such as a parent or employer, can later retrieve the screen images to provide a graphical record of the activities, such as that of their child or employees, on that computer. The system and method of the present invention gives full authority of determining what type of computer usage is inappropriate or offensive to the computer operator. Through the use of the present invention, an operator may determine not only whether or not a user&#39;s computer activity was inappropriate, but may also simply determine if the computer was operated in any manner. By employing the system and method of the disclosed invention, a record of a user&#39;s activity or inactivity is created that, in addition to being highly simple to evaluate, is an irrefutable account of the user&#39;s computer usage. Variations of the system and method allow the operator to direct monitoring events toward online or off-line activities.

[0001] This nonprovisional application claims priority based upon thefollowing prior U.S. Provisional Patent Application: FILING Ser. No.DATE TITLE INVENTOR 60/055,523 Aug. 7, 1997 System and Method Laslo Olahfor Monitoring Computer Usage

BACKGROUND OF THE INVENTION

[0002] Technical Field of the Invention

[0003] The present invention relates to the monitoring of computer usageand, in particular, to a system and method for monitoring or recording auser's activity on a computer system by capturing the content on adisplay screen.

Background and Objects of the Present Invention

[0004] Since the introduction of the personal computer in the early1980's, the PC has been subject to constant change, ever increasing incapability and usage. From its earliest form in which the dataaccessible was limited to that which the user could load from a floppydisk to the typical gigabyte hard drives common on PCS today, the amountof data and the ease of obtaining this data have been growing rapidly.With the fruition of the computer network, the available data is nolonger limited to the user's system or what the user can load on theirsystem. Local Area Networks or LANs are now common in small businesses,and in such networks users may, in addition to their own local data,obtain data from other local stations as well as data that is availableon the local server. Corporate networks and internetworks may connectmultiple LANs, thereby increasing the data available to users. Largerstill are Wide Area Networks (WANs) and Metropolitan Area Networks(MANs), the latter of which is designed to cover large cities.

[0005] The largest such network, commonly known as the Internet, hasintroduced vast amounts of information into the business place and thehome. The individual networks that make up the Internet include networkswhich may be served from sources such as commercial servers (.com),university servers (.edu), research networks (.org, .net), and militarynetworks (.mil). These networks are located throughout the world andtheir numbers are ever increasing with an estimated 85,000 new domainregistrations presently occurring each month with countless Internetsites spawned from these domains.

[0006] With the exponential growth of the Internet and the explosion ofinterest worldwide, one natural consequence of this profundity is agrowing diversity in the subject matter of the available information.Although this was the original intent of the Internet developers, thereare obvious disadvantages and undesirable consequences of such a globalinformation exchange. What is quickly becoming a notorious example ofsuch occurrence is the proliferation of pornography, hate materials, andother materials, some of which may not only be offensive, but illegal.

[0007] A specific difficulty encountered with the introduction of thispowerful informational tool in the business and home is the logisticalproblem of governing the usage of the available data to specific users.In a corporate environment with access to, for example, the Internet, itis obviously advantageous for management to be able to limit or monitorin some fashion their employees' usage of such a resource not only toensure productivity but to prevent liability for inappropriate employeeInternet activities. Likewise, in the home, a parent may desire to havethe beneficial educational information that exists in great quantity onthe Internet available for their child, but, at the same time, may wishto prevent that child from accessing inappropriate materials, either byintent or accident.

[0008] In the discussion that follows, ‘operator’ will refer to theperson attempting to monitor or block another person's activity on acomputer system by any method or means. ‘User’ will refer to the personwhose computer activity is subject to being monitored or blocked.

[0009] Currently, those companies with the financial resources desiringthe efficiency of exchanging information through the Internet may electto use an intranet, e.g., a LAN. This way, the company can distributeinformation to its employees with the conveniences of the Internet, butwithout actually being connected to the Internet. The company may alsoeither block specific domains from access by its employees, or giveaccess to only specified domains. This may be achieved by appropriatesoftware or coding to block domains at a gateway or firewall. However,these methods may not be financially or technically feasible, or thismay not serve the companies' intent in any regard. Also, this techniquedoes not prevent employees from loading computer games on their computerand playing them during work hours. Often, a company may desire that itsemployees have unlimited access to data resources through the Internetwith the only restriction being that their access is useful forfulfilling the duties of their jobs. In this instance, it would becounterproductive to give access to only certain domains, as doing sowould block access to future domains that may provide informationbeneficial to serving well an employee's position.

[0010] Commercially available applications to help combat this problemon the home or business PC are well known, such as Net Nanny™, SurfWatch™, and NetSnitch™. These applications and their respectivelimitations are now discussed.

[0011] Net Nanny™ is a software utility marketed to control, primarily,children's access to offensive Internet sites. This software's primaryfunctionality is the use of an operator-defined, customized dictionaryof terms or phrases to be blocked from access. In operation, Net Nanny™performs a system shutdown whenever any material matching criteria inthe operator-defined dictionary is accessed. This product works offlineas well as online and performs a system shutdown when material matchingspecified criteria are accessed, where the material to be blocked couldbe loaded from floppy disks, CD-ROMS, local hard drives, network drives,or any other appropriate media. It can also be configured to provide theuser a warning or to create a log of “offenses”—accesses to materialthat have been defined as offensive in the customized dictionary.Specific sites are also able to be blocked by the software operator, andsimilarly, the operator may make only certain sites available to beaccessed.

[0012] Although this specific, operator-defined approach is somewhatuseful, a number of limitations are apparent. For example, in utilizinga customized dictionary to block sites by keyword, the operator isresponsible for formulating a list of words or phrases that could beincluded on a site with offensive material. Any descriptive phrases orterminology overlooked or unknown by the operator may therefore bereadily available to the user. In addition, material deemed offensive tothe operator is not necessarily described on a website by offensivedescriptive words that would be detected by the blocking software. Forexample, pornographic material may be served from a server in a numericindex format. In this case, graphic files may be sequentially numberedwith no descriptive text on that site. In this instance, it would not bepossible for the blocking software to detect the presence of theoffensive graphic material. The same case would be true when operatingthe blocking software offline. Unless a graphic file, for instance, wasnamed with a title that matched an offensive criteria, the file could beviewed without generating a detection by the blocking software.

[0013] SurfWatch™ is another program designed to block children's oremployees' access to offensive Internet sites. It is intended to solelyblock offensive Internet sites and is therefore utilized only for onlineactivities. Primarily, it relies on blocking sites by use of a databasethat contains sites that have been determined to be offensive and by theuse of keyword filters. The database is periodically updated and isavailable through a service with payment of a licensing fee. Through thelicensing agency, criteria have been established as to what material isdeemed offensive, which includes, but is not limited to, sexuallyexplicit, violent, and/or illegal drug information. The softwareoperator has configuration options available to alter the criteria bywhich Internet sites are blocked.

[0014] Again, the limitations are obvious. By relying on a licensingagent to develop updated databases of offensive sites, the operator isreliant on the agent to determine or locate any and all such sitescontaining material that is offensive. At best, the agent would be ableto eliminate a large majority of such sites. It would not be reasonable,however, to expect such an agency to be able to locate every possiblesuch site.

[0015] Additionally, there would exist a necessary delay in the creationof a new site containing offensive material and the time at which it isdetected by the licensing agency and updated in the database of blockedsites. During that time, any user utilizing a system with the blockingsoftware implemented by an operator would have unrestricted access tothat site, assuming that the site did not contain descriptors matchingthose in the filtering module of the software.

[0016] A further problem of such a blocking method is that the operatoris relying on a third party, the licensing agency, to concur with theoperator in the subjective determination of what material is offensive.This method, in its most fundamental aspect, removes from the operatorthe ability to censor objectionable material as deemed objectionable bythe operator. This limits the control of the operator to the task offormulating descriptive terms and phrases to be used by the filteringmodule, a method similar to and with limitations consistent with thepreviously discussed prior art application.

[0017] Another commercially available application is NetSnitch™ whichdoes not actively block Internet sites, as the previously discussed artdoes, but instead creates a log of Uniform Resource Locators (URLs) thatcan later be reviewed and loaded by the software operator to determinewhat type of Internet sites have been visited by the user. It isdesigned to function online and, therefore, its usefulness is limited toonline activities. When the user goes online, a log is activated whichlists the specific Internet sites the user visits by recording thatsite's URL. It is, therefore, used as a monitor of user activity byallowing the software operator to later retrieve the log, and ifdesired, to go online and load the URLs one at a time to investigatewhat type of content is contained at the sites accessed by the user. Asis apparent, this method does not offer any type of site blocking butgives, in one form, a complete history of the user's activity online,which is recorded by each site's URL.

[0018] An obvious limitation of this method, however, is that it onlyworks online. Offensive material may be loaded by floppy disk, forexample, and viewed without the monitoring software ever beingactivated. Furthermore, for the operator to determine the user's onlineactivity history, it is necessary for the operator to go online him orherself, and load each URL to investigate the material at each site, atime consuming and inconvenient task. Also, none of the above techniquesis able to verify the user's actual activities, e.g., the content of auser's discussion in an on-line “chat-box,” which can be pornographic,racial or hate related.

[0019] It is, therefore, evident that the need exists for a convenientsystem and method for monitoring a computer user's activity by anoperator, while not limiting the user's computing or informationalallowances. Although a great deal of today's PC users' data is generatedfrom Internet usage, it has been established that a need exists for asoftware application to be effective offline, as well as online. It isfurther desired that no limitations be placed on what type of materialis to be monitored and for the application to take no action against theuser and, additionally, for the application to give no suggestion to theuser of the application's operation. In doing so, the operator wouldhave sole discretion as to what type of usage is objectionable oroffensive and as to what course of action should be taken.

SUMMARY OF THE INVENTION

[0020] The present invention is directed to a system and method formonitoring computer usage. In a preferred embodiment, a computeroperator specifies discrete moments of a computer's usage at whichscreen captures are executed and saved to a log. The operator, such as aparent, can later retrieve the screen images to provide a graphicalrecord of the activities, such as that of their child, on that computer.The system and method of the present invention overcomes the limitationsand inefficiencies of the prior art and gives full authority ofdetermining what type of computer usage is inappropriate or offensive tothe computer operator. Through the use of the present invention, anoperator may determine not only whether or not a user's computeractivity was inappropriate, but may also simply determine if thecomputer was operated in any manner. By employing the system and methodof the disclosed invention, a record of a user's activity or inactivityis created that, in addition to being highly simple to evaluate, is anirrefutable account of the user's computer usage. Variations of thesystem and method allow the operator to direct monitoring events towardonline activities.

BRIEF DESCRIPTION OF THE DRAWINGS

[0021] A more complete understanding of the system and method of thepresent invention may be had by reference to the following detaileddescription when taken in conjunction with the accompanying drawingswherein:

[0022]FIG. 1 is an exemplary embodiment of a conventional computersystem which may employ the subject matter of the present invention;

[0023]FIG. 2 is an example of a main program interface utilized by thesystem and method of the present invention, particularly using thecomputer system of FIG. 1;

[0024]FIG. 3 illustrates a configuration interface activated when theoperator chooses to continuously monitor a computer's usage with manualentry of screen capture times;

[0025]FIG. 4 is an interface activated when the operator chooses to viewcaptured images;

[0026]FIG. 5 is a configuration interface activated when the operatorchooses to manually select the screen capture times and also chooses tohave screen captures activated by modem downloads only; and

[0027]FIG. 6 illustrates a sample interface for selecting displayformats.

DETAILED DESCRIPTION OF THE PRESENTLY PREFERRED EXEMPLARY EMBODIMENTS

[0028] The present invention will now be described more fullyhereinafter with reference to the accompanying drawings, in whichpreferred embodiments of the invention are shown. This invention may,however, be embodied in many different forms and should not be construedas limited to the embodiments set forth herein; rather, theseembodiments are provided so that this disclosure will be thorough andcomplete, and will fully convey the scope of the invention to thoseskilled in the art.

[0029]FIG. 1 illustrates a computer system incorporating the monitoringprogram according to the present invention. A file server 8 connectsremote computers 2, 4 and 5 through the use of a network connection,generally represented by the reference numeral 1. File server 8 furtherconnects computers 2, 4, and 5 to the Internet 9 via a gateway 7. Remotecomputers 4 and 5 are, in addition to their own local hard drives,equipped with external storage devices 11 and 13, respectively. Computer5 is further networked to include computer 15 operating remotely fromit. Of course, the number and arrangement of the computers in thenetwork depicted in FIG. 1 have been arbitrarily selected and in no waylimit the merits of the present invention.

[0030] It should be understood that since the exact configuration of thecomputer system components may vary greatly, the present invention, asset forth in the proceeding discussion, would be effective in any numberof network configurations. Furthermore, the present invention is notlimited to the various expansions or rearrangements on the network asdescribed in FIG. 1, but also applies to a stand alone system, which maybe defined as a computer system with no available resources outside itsown physical devices. In addition, in the continuing discussion,reference will be made to operation of the invention in a networkenvironment.

[0031] As an example of the potential usage of the disclosed invention,the particular network configuration of FIG. 1 is first considered in anoffice environment. In this example, an employer has employees operatingfrom local computers 2, 4, 5, and 15. Employees are served files andInternet access through the server 8. In doing so, the employer wishesto discretely monitor the employees usage of their local computers.Utilizing the disclosed invention, the employer may go about this in anumber of ways. The subject matter of the invention, which is preferablyembodied in software, is loaded and configured on each of the employees'computers, 2, 4, 5, and 15. After some time of employee computeractivity, the employer could return to each of these machines, andthrough functions later discussed, retrieve a visual log of the users'activities.

[0032] The employer may also choose to run the invention from server 8with specific configuration made for each employee computer, 2, 4, 5,and 15. The employer may only wish to monitor one employee, 15 forinstance. The employer may feel that the employee on computer 15 isespecially savvy and may feel it is a possibility that this employeewould discover the operation of the disclosed invention on the localcomputer. With the network configuration shown, the employer could run amonitoring routine from computer 5 or the server 8, with computer 15being the target for monitoring user activity.

[0033] It should be understood that regardless of whichever computerusage is subject to being monitored in such a network environment, thedisclosed invention may be run from the targeted computer, from anetwork server, or from any other computer sharing appropriatecommunication paths with the targeted computer. Furthermore, theretrieval and viewing of monitored computer usage is not limited to thetargeted computer or the computer from which the monitoring function wasimplemented from, but instead, it could be viewed from yet anothercomputer with appropriate communication paths between itself and thedisclosed invention.

[0034] The preferred embodiment of the present invention and itsadvantages are best understood by referring to FIGS. 2-4 of thedrawings. FIG. 2 shows a main menu interface of the present invention. Anumber of configuration options are available to the operator. Toimplement the invention, the operator would select icon 10, ‘Total,’ and20, ‘Manual Setup’ from these options. The ‘Total’ option, 10, specifiesthat the monitoring routine of the present invention will continuouslymonitor the computer usage, regardless of its operating condition. The‘Manual Setup’ option, 20, specifies that the operator will determine atwhat discrete moments the monitoring routine will execute screencaptures and save these screen captures in an activity log. Afterselecting options 10 and 20, the operator must specify when the screencaptures are to occur. This is done through an interface such as shownin FIG. 3.

[0035] The screen capture interface prompts the operator for thediscrete moments at which the screen captures are to be executed, and isactivated from the interface of FIG. 2 when the operator has selectedeither of options 10 and 20. In the example interface depicted in FIG.3, the operator is prompted for five distinct hourly moments at whichthe screen capture is to be executed.

[0036] The actual time of the executions are specified relative to eachhour of the day and are governed by the system clock. The operator wouldthen enter respective values in the areas 30, 31, 32, 33, and 34.Entries are numerical values greater than or equal to 1 and less than orequal to 60, i.e., 1-60 minutes. For example, if the operator entered‘03’ in the area 30, a screen capture would be executed and recorded atthe first second of the third minute of each hour that the computer wasrunning. This screen capture would be in addition to those entered in31, 32, 33, and 34. Again, all times are consistent with the systemclock from which the present invention is operating. Although in thepresent example, five screen captures per hour are specified by theoperator to be executed, it is nonetheless apparent that the number ofscreen captures performed is arbitrary and may vary pursuant to operatorcriteria or preferences.

[0037] Once the operator has configured the program to the desiredspecifications, a confirmation message is generated informing theoperator that the software is configured and ready to monitor a user'sactivity. No further action is then required by the operator untilviewing the results. The system may be shut down or allowed to continuerunning. Either way, the program monitors a user's activity once thespecified criteria in the program's configuration settings aresatisfied.

[0038] The operator may later retrieve the saved screen captures. Theoperator would begin the retrieval from the main menu, as shown in FIG.2. Here, the operator has the option of viewing the activity log in 24hour mode, 12, or am/pm mode, 14. After selecting the mode, the operatorselects option 40, ‘Show Saved Data.’ For security purposes, e.g., toprevent a child or employee from accessing or modifying the log, thisoption preferably activates a password screen. It should be understood,however, that password verification may be implemented during otherparts of the monitoring routine, particularly in accessing the initialscreen shown in FIG. 2. Ideally, the operator would be the only personwith knowledge of the password. Once the operator has successfullyentered the correct password, the monitoring routine prompts theoperator to choose between viewing saved screens or saved statistics.

[0039] Assuming the operator chooses to view the saved screens, aninterface similar to FIG. 4 is activated. The operator can then chooseto view all the saved screens by selecting the appropriate object, 50,or the operator may choose to view the saved screens during a specifictime period. To do this, the operator simply enters the range of datesand hours in areas 55 and 60. The procedure would be the same in 24hours mode except the time is entered in by selecting hours from 1 to 24as opposed to selecting the hour and choosing am or pm in am/pm mode.When the operator makes their viewing selection, the first saved screenappears in a window with a date/time stamp appearing in the upper righthand corner. A sample interface for such a screen is shown in FIG. 6.The operator then has the option to go forward to the next capturedimage 70, return to the previous image 75, or delete the captured image80.

[0040] The operator can then view the next captured image by selectingobject 70, marked ‘Next’. By viewing each consecutive image with thetime/date stamp marked on it, the operator has a graphic time line of auser's activity on the computer. Assuming the program had beenconfigured to operate continuously, any hourly time periods without anysaved images would indicate a period of computer inactivity. Therefore,the operator has not only a historical profile of a user's activity, butcan also gain information as to a user's periods of inactivity. Avariation is included herein where an operator may not find it necessaryto save actual images of a user's session, but may instead elect to savestatistical information on a user's activities. This capturing ofstatistical information would be configured in a manner similar to thatjust described, only statistics such as download sites, times, dates,file names, sizes, applications running at specific times, and anynumber of other useful statistics lending information as to a particularuser's computer activity would be entered in the log instead of anactual image of the screen capture.

[0041] A variation on this embodiment would allow the operator tospecify time periods of continuous monitoring. In this manner, theoperator may specify periods when no monitoring is desired or stop themonitoring program from running until reactuated by the operator. In abusiness office, this would be convenient for off hours. A similarexample for the home may be when a child is in school. By makingadjustments in the configuration options of the invention, this wouldallow an operator to avoid unnecessary monitoring, thereby expeditingfuture review of captured data and avoiding monitoring of incidentalusage.

[0042] In a second embodiment of the present invention, the operator mayelect to have the times of screen capture execution automaticallyselected as opposed to manually entering the times. The operator isallowed this option by selecting 10, ‘Total,’ and 16, ‘Random Savings,’from the configuration interface shown in FIG. 2. In implementing thisoption, the software monitoring utility changes the time of the firstthrough fifth screen captures each hour. This provides an addedprotection against a user who is capable of determining the intervals atwhich the screen capture is implemented. Although it is unlikely, it ispossible a user could discover the occurrence of the monitoring event bytangible signals generated by the computer, such as a hard disk activitylight. By using option 16 of FIG. 2, the operator allows the times atwhich the screen captures are executed to vary by the hour, thusprohibiting the user from determining the particular minute or othertime measure at which the capture will occur. The operator may thenlater retrieve captured images or statistics in a manner that isconsistent with that described in the first embodiment. In a furthermodification, the program of the present invention allows the operatorto specify periods when no monitoring is to be implemented.

[0043] In a third embodiment of the invention, a monitoring scheme moredirected at determining a user's online activity is allowed. In thisembodiment, the monitoring is not initiated until a modem download isdetected. The operator may configure it to monitor at the discretemoments selected by the operator similar to the method described inembodiment 1. To do this, the operator would choose 18, ‘Modem’, and 20‘Manual Setup’, from the interface depicted in FIG. 2. Doing so wouldactivate the configuration screen shown in FIG. 5.

[0044] At this modem-download interface, times are entered by theoperator in the appropriate areas 90, 91, 92, 93, and 94. One differencein the functionality of this configuration compared to the configurationdescribed in the first embodiment is that in this configuration, screencaptures are not executed until a modem download occurs. When a modemdownload occurs, the entries made by the operator in the interfacedepicted in FIG. 4 are compared to the system clock and a capture isexecuted when a minute on the system clock is consistent with a minuteentered by the operator at this interface.

[0045] It should be understood that in operating the invention accordingto this embodiment, a user's session in which no online activity occurswill not be subject to monitoring. Accordingly, an operator would onlyuse this configuration when interested solely in monitoring a user'sonline activity. The operator may then later retrieve captured images orstatistics in a manner that is consistent with that described in thefirst embodiment. With additional modification, the invention allows theoperator to specify periods when no monitoring is to be implemented.

[0046] In a fourth embodiment of the present invention, the operator hasanother configuration available that may be directed to monitoringonline activity. The operator may choose this configuration byrespectively selecting 18 and 16 from the interface depicted in FIG. 2.The functionality of this configuration is similar to that described inthe second embodiment with the exception that screen captures are notexecuted until the detection of a modem download. For each modemdownload, screen captures will be executed at the first second of fiverandomly selected minutes over an hour interval, the pattern repeatingfor each hour designated. The operator may then later retrieve capturedimages or statistics in a manner that is consistent with that describedin the first embodiment. With some modification, the invention allowsthe operator to specify periods when no monitoring is to be implemented.

[0047] In addition to password usage, a further degree of operationalintegrity may be implemented to increase the difficulty of a userdeleting the saved images in the case the user is able to discover theoperation of the disclosed invention. This may be done by introducing aseries of keywords or numerical entries that must be correctly enteredin order to confirm the deletion. Ideally, only the operator would beknowledgeable of such information, and thus, even if the user discoversthe operation of the invention, the possibility of the user beingcapable of deleting the saved data or disabling the program is furtherminimized.

[0048] Instead of a series of password requests, the program couldinstead require multiple request screens to cancel or delete themonitoring program or the stored data. Preferably, the number ofdistinct requests and requisite responses (clicks) handles the situationwhere the operator has forgotten the password and needs to cancel theprogram, e.g., before the harddrive falls. Although the user could inprinciple then delete the downloaded data (and even the monitoringprogram itself), the user would be unable to say the deletions wereaccidental if a large number, e.g., 21, of discrete steps were necessaryto accomplish deletion.

[0049] It should be understood that the series of screendownloads/statistical data, stored on the storage devices 11 and 13 orupon the harddrives of the various computers depicted in FIG. 1, may bedisplayed as they appeared on the user's screen, e.g., display terminal5A of computer 5, at the time of downloading, e.g., an image 5B thereon,or multiple such downloads displayed. In particular, the operator mayselect the manner of display and illustrate the user's usage of thecomputer by displaying multiple images/data alongside each other, e.g.,an entire hour's worth of activity may be displayed on the terminal 5A,each image being reduced in size and resolution to fit. The images maybe aligned or overlaid to better show computer usage over longer periodsof time.

[0050] It should also be understood that the intercepted screendownloads/statistical data or other data transmissions may be stored onthe aforementioned storage devices 11 and 13, harddrives, zip drives orany other type of memory storage.

[0051] Although various embodiments of the method and apparatus of thepresent invention have been illustrated in the accompanying Drawings anddescribed in the foregoing Detailed Description, it will be understoodthat the invention is not limited to the embodiments disclosed, but iscapable of numerous rearrangements, modifications and substitutionswithout departing from the spirit of the invention as set forth anddefined by the following claims.

What is claimed is:
 1. A method for monitoring usage activities of auser on a computer system, said method comprising the steps of:intercepting a data transmission within said computer system, said datatransmission corresponding to the image being displayed on a displayconnected to said computer system; storing, within a memory, saidintercepted data transmission; and viewing said intercepted datatransmission on a display device connected to said computer system. 2.The method according to claim 1, further comprising, prior to said stepof intercepting, the step of: defining at least one time at which saidinterception of said data transmission occurs.
 3. The method accordingto claim 2, wherein said step of defining is performed by an operator ofsaid computer system.
 4. The method according to claim 2, wherein, insaid step of defining, a multiplicity of discrete times are defined forintercepting a respective multiplicity of data transmissions, therespective data transmissions corresponding to the respective imagesbeing displayed on said display at said discrete times.
 5. The methodaccording to claim 4, wherein said multiplicity of discrete timescorrespond to discrete positions within a given time interval.
 6. Themethod according to claim 5, wherein said given time interval is anhour.
 7. The method according to claim 4, wherein, in said step ofdefining, said multiplicity of discrete times are randomly defined, saidinterceptions of the data transmissions over a given time interval beingrandomly spaced apart.
 8. The method according to claim 7, wherein saidinterceptions of the data transmissions over a second time interval arealso randomly spaced apart.
 9. The method according to claim 1, furthercomprising, prior to said steps of intercepting and storing, the stepof: detecting a download data transmission to said computer system, saiddownload data transmission detection triggering said step ofintercepting.
 10. The method according to claim 9, wherein said downloaddata transmission is via a modem.
 11. The method according to claim 1,wherein said step of storing further comprises the step of appendingtime and date information of said intercepted data transmission.
 12. Themethod according to claim 1, wherein statistical information on saidintercepted data transmission in view during said viewing step.
 13. Themethod according to claim 1, wherein a multiplicity of datatransmissions are intercepted and stored, a plurality of saidtransmissions being subsequently simultaneously viewed on said display.14. The method according to claim 13, wherein at least two of said datatransmissions are viewed on said display.
 15. The method according toclaim 14, wherein said at least two data transmissions correspond torespective images of the usage activities of said user on said computersystem on at least two times.
 16. The method according to claim 1,wherein, in said step of viewing, an operator selectively views amultiplicity of intercepted data transmissions stored within saidmemory.
 17. The method according to claim 1, wherein, in said step ofintercepting, said computer system intercepts a data transmission withina remote computer system, said intercepted data transmission beingstored within said memory in said computer system.
 18. The methodaccording to claim 17, wherein said computer system is a server.
 19. Themethod according to claim 1, further comprising, prior to said step ofintercepting, the step of: selectively activating said monitoring ofusage activities, said intercepting and storing steps being deactivatedby an operator for a given time interval.
 20. A monitor for monitoringusage activities of a user on a computer system, said monitorcomprising: interception means for intercepting a data transmissionwithin said computer system, said data transmission corresponding to theimage being displayed on a display connected to said computer system;storage means, connected to said interception means, for storing saiddata transmission; and viewing means, connected to said storage means,for viewing said data transmission.
 21. The monitor according to claim20, further comprising: time defining means for defining at least onetime at which said interception means intercepts said data transmission.22. The monitor according to claim 21, wherein a multiplicity ofdiscrete times are defined by said time defining means, the respectivedata transmissions corresponding to the respective images beingdisplayed on said display at said discrete times.
 23. The monitoraccording to claim 22, wherein said multiplicity of discrete timescorrespond to discrete positions within a given time interval.
 24. Themonitor according to claim 23, wherein said given time interval is anhour.
 25. The monitor according to claim 22, wherein said multiplicityof discrete times are randomly defined, said interceptions by saidinterception means being randomly spaced apart over a given timeinterval.
 26. The monitor according to claim 20, wherein saidinterception means intercepts said data transmission after detecting adownload data transmission.
 27. The monitor according to claim 26,wherein said download data transmission is via a modem.
 28. The monitoraccording to claim 20, wherein said viewing means displays statisticalinformation on said intercepted data transmission.
 29. The monitoraccording to claim 28, wherein said statistical information is selectedfrom the group consisting of download sites, times, dates, file names,file sizes, and applications running at a particular time.
 30. Themonitor according to claim 20, wherein said interception meansintercepts a multiplicity of data transmissions and said storage meansstores said multiplicity of data transmission, said viewing meanssubsequently and simultaneously displaying a plurality of said datatransmissions on said display.
 31. The monitor according to claim 30,wherein at least two of said data transmissions are viewed on saiddisplay.
 32. The monitor according to claim 20, further comprising: aremote computer system, connected to said computer system, saidinterception means intercepting a data transmission within said remotecomputer system, said intercepted data transmission being stored withinsaid storage means in said computer system.
 33. The monitor according toclaim 32, wherein said computer system is a server.
 34. The monitoraccording to claim 20, further comprising: deletion means, within saidcomputer system, for deleting at least one said data transmission storedon said storage means, said deleting means having a multiplicity ofinformational requests prior to deletion.
 35. A program storage devicereadable by a machine and encoding a program of instructions forexecuting the method steps of claim
 1. 36. An article of manufacturecomprising a computer usable medium having computer readable programcode means embodied thereon for monitoring usage activities of a user ona computer system, the computer readable program code means in saidarticle of manufacture comprising: (a) computer readable program codefor intercepting a data transmission within said computer system, saiddata transmission corresponding to the image being displayed on adisplay connected to said computer system; (b) computer readable programcode for storing, within a memory, said intercepted data transmission;and (c) computer readable program code for viewing said intercepted datatransmission on a display device within said computer system.